5 ms·

Pi-hole covers you regardless of browser.

by jaxn 8y ago

xythian 8y ago
Yes, but also less so every day. Google has already figured out that they should serve Youtube ads and content from the same servers to limit the ability of DNS based ad filtering. DNS filtering is a cat-and-mouse game that DNS filtering tools will eventually lose. Don't get me wrong, I love Pihole and have used it for a while, but I know that I'm on the losing side of this battle.
- seanp2k2 8y ago
  DNS filtering has been on the "losing side" for a few decades now. As long as more than 0.1% of people don't use it, it's not worth solving for most ad companies. Even if places like YouTube DO find ways to stuff ads into my face (likely at great technical and operational expense to them), I make it a point to NEVER EVER buy anything advertised, search for any of it, etc. Because they know so little about me (I go out of my way to block as much telemetry and data sharing as possible), their ads aren't very relevant to me anyway, so they're literally just wasting money serving me an ad, trying to pressure me into paying for their premium service. Instead, I just get annoyed if there are too many ads and find something else to do. It would probably serve them better to just realize that some users won't ever convert, and stop wasting time serving them ads.
  - dylan604 8y ago
    So you're getting down voted, but I totally agree. I too used to disable javascript using NoScript every where until it was a site that I was okay with. I played the game of only allowing javascript from the same domain, and then looking at the remaining scripts the site wanted to request. CDNs for jQuery, FontAwesome, etc, started to get whitelisted. Anything else, nope. If the site didn't work after that, then the tab was closed. After allowing NoScript to run javascript, I would then lean on uBlock to block the trackers etc that were loaded by anything I missed. It's amazing how difficult surfing the web like this was.
  - briandear 8y ago
    Maybe if you won’t ever convert, they should simply stop wasting time serving you anything? YouTube isn’t a charity.
    - visarga 8y ago
      How could YouTube know you won't ever convert beforehand, and at scale? If they started blocking users for suspicion of not buying anything from ads they would have to block a sizeable portion of their traffic and that would have a negative impact on their company.
      - jaxn 8y ago
        YouTube doesn't care if you buy what the ad is selling. They are selling the fact that you viewed the ad.
    - notacoward 8y ago
      They're not a charity, but their business model is based on ads and they rely on the network effect to support that model. People who can't see anything at all will immediately defect. No revenue at all from the moment that policy is implemented, plus significant risk that enough will leave to weaken the network effect. People who are forced to watch ads with their content will grumble, some of them might eventually defect, but for the most part they will stay and continue generating revenue. Less immediate impact to the bottom line, and hardly any risk of undermining the network effect. The "just go away" approach is proving suicidal for online newspapers and magazines. It would be no less so for YouTube. Their content is neither compelling enough nor exclusive enough for that to work.
treypitt 8y ago
setting up a dedicated linux box to run pi-hole is a lot harder than installing a browser extension (but I agree it's awesome)
darkpuma 8y ago
Pi-hole and similar solutions are crude compared to uMatrix. I wish that weren't the case. If we didn't have to rely on browser extensions for fine-grained control then alternative browsers like qutebrowser could become more than just toys.
jlarocco 8y ago
Network level ad-blocking doesn't work very well. Privoxy (and Proxomitron before it) were doing it 20 years ago, but never caught on because they're a PITA to setup and can't handle inline adverts. Pi-hole is new, but it's even more work to setup, and suffers the same limitations. And as ad-blocking has become more popular the problems only gotten worse. It's unusual that I see any ads any more, but when I do it's always in an inline div or span with a "random" id or class name, essentially invisible to pi-hole.
- givinguflac 8y ago
  I can’t speak for pi-hole, but Diversion on Asuswrt-Merlin works fantastic for me. No ads ever except for YouTube ads lately due to google’s changes to how they serve ads from the same servers they provide services on.
  - jlarocco 8y ago
    > No ads ever except for YouTube ads lately due to google’s changes to how they serve ads from the same servers they provide services on. Thats what I meant by network level blocking doesn't work very well. Using uBlock Origin, I don't see YouTube ads.
    - givinguflac 8y ago
      There's a huge difference between "doesn't work very well" and "works perfectly except for one really sneaky ad company, sometimes". How does ublock origin cover scripts and ads for my entire network? Did you even look at what I'm talking about before making such general statements? My router blocks hundreds of thousands of incidents per week, and there are only two people in my household. One can't use a browser plugin on android tv, Apple TV, smart tv, and a million other devices. By your own logic, ublock origin doesn't work very well. See what I mean?
- maverick2007 8y ago
  Why doesn't it? (Not a leading question, I just don't understand why it doesn't) Isn't the way uBlock and the like work is that they see network requests from a blacklist and not load those resources? Isn't network level blocking just moving that from the local device up a level?
paavoova 8y ago
So this only blocks/matches known domains? That isn't nearly as useful as to what uMatrix/uBlock allow, such as filtering by resource type. E.g. you may want to disable all JS by default, which uBlock allows.
- berbec 8y ago
  Yes. Pihole and the like can only block domains, adserver.doubleclick.com.
davb 8y ago
One of my concerns is that DNS over HTTP(s) is really just a way to obfuscate DNS queries from the oversight of network level ad blockers like Pi Hole, AdBloka et al.
- berbec 8y ago
  That's why you use DoH from you pihole, not your computer/phone etc.
  - davb 8y ago
    Of course, but my concern is that DoH makes it easier for apps (Chrome, etc) to handle their own DNS queries internally rather than relying on the device's network libraries. MiTM intercepting HTTP(s) traffic on my Android devices is really difficult due to certificate pinning. The only way to quantify how many unexpected requests apps are making was to watch DNS traffic. If, one day, these apps just make a single DNS request to Google's DoH host then encrypt all their traffic from there onwards, I'd have no insight into what's going on in my own device.
    - anfilt 8y ago
      I am not a fan of DNS over HTTPs for similar reasons too.
- ocdtrekkie 8y ago
  You might've noticed most of the new Internet protocols Google is championing move to pushing things through HTTPS where they cannot be intercepted and provide a guaranteed tunnel between the servers (statistically speaking, Google), and the browser (also, statistically speaking, Google). I would never go so far as to speculate why, but it does appear Google is heavily focused on this.
propogandist 8y ago
The new trend to slip through is hiding behind cloudflare. I see cloudflare urls being loaded within cloudflare URLs to obfuscate the source of ads and scripts
Kadin 8y ago
I have a Pi-hole and use uBlock; when I turn off uBlock and use the Pi-hole alone, a ton of ads still seem to come through. This is with the default blocklists (StevenBlack, MalwareDomains, sysctl.org, zeustracker.abuse.ch; about 8 total). Maybe I'm not adding enough lists, but "out of the box" it doesn't seem to cut it.
- jaxn 8y ago
  You may have a secondary DNS. Sometimes that isn't even intentional as ISP modems automatically upstream failed DNS regardless of the local DHCP settings (I'm looking at you AT&T Fiber)

Pi-hole covers you regardless of browser.

by jaxn 8y ago

Pi-hole covers you regardless of browser.

Yes, but also less so every day. Google has already figured out that they should serve Youtube ads and content from the same servers to limit the ability of DNS based ad filtering. DNS filtering is a cat-and-mouse game that DNS filtering tools will eventually lose. Don't get me wrong, I love Pihole and have used it for a while, but I know that I'm on the losing side of this battle.

seanp2k2 8y ago
DNS filtering has been on the "losing side" for a few decades now. As long as more than 0.1% of people don't use it, it's not worth solving for most ad companies. Even if places like YouTube DO find ways to stuff ads into my face (likely at great technical and operational expense to them), I make it a point to NEVER EVER buy anything advertised, search for any of it, etc. Because they know so little about me (I go out of my way to block as much telemetry and data sharing as possible), their ads aren't very relevant to me anyway, so they're literally just wasting money serving me an ad, trying to pressure me into paying for their premium service. Instead, I just get annoyed if there are too many ads and find something else to do. It would probably serve them better to just realize that some users won't ever convert, and stop wasting time serving them ads.
- dylan604 8y ago
  So you're getting down voted, but I totally agree. I too used to disable javascript using NoScript every where until it was a site that I was okay with. I played the game of only allowing javascript from the same domain, and then looking at the remaining scripts the site wanted to request. CDNs for jQuery, FontAwesome, etc, started to get whitelisted. Anything else, nope. If the site didn't work after that, then the tab was closed. After allowing NoScript to run javascript, I would then lean on uBlock to block the trackers etc that were loaded by anything I missed. It's amazing how difficult surfing the web like this was.
- briandear 8y ago
  Maybe if you won’t ever convert, they should simply stop wasting time serving you anything? YouTube isn’t a charity.
  - visarga 8y ago
    How could YouTube know you won't ever convert beforehand, and at scale? If they started blocking users for suspicion of not buying anything from ads they would have to block a sizeable portion of their traffic and that would have a negative impact on their company.
    - jaxn 8y ago
      YouTube doesn't care if you buy what the ad is selling. They are selling the fact that you viewed the ad.
  - notacoward 8y ago
    They're not a charity, but their business model is based on ads and they rely on the network effect to support that model. People who can't see anything at all will immediately defect. No revenue at all from the moment that policy is implemented, plus significant risk that enough will leave to weaken the network effect. People who are forced to watch ads with their content will grumble, some of them might eventually defect, but for the most part they will stay and continue generating revenue. Less immediate impact to the bottom line, and hardly any risk of undermining the network effect. The "just go away" approach is proving suicidal for online newspapers and magazines. It would be no less so for YouTube. Their content is neither compelling enough nor exclusive enough for that to work.

treypitt 8y ago

setting up a dedicated linux box to run pi-hole is a lot harder than installing a browser extension (but I agree it's awesome)

darkpuma 8y ago

Pi-hole and similar solutions are crude compared to uMatrix. I wish that weren't the case. If we didn't have to rely on browser extensions for fine-grained control then alternative browsers like qutebrowser could become more than just toys.

jlarocco 8y ago

Network level ad-blocking doesn't work very well. Privoxy (and Proxomitron before it) were doing it 20 years ago, but never caught on because they're a PITA to setup and can't handle inline adverts. Pi-hole is new, but it's even more work to setup, and suffers the same limitations. And as ad-blocking has become more popular the problems only gotten worse. It's unusual that I see any ads any more, but when I do it's always in an inline div or span with a "random" id or class name, essentially invisible to pi-hole.

givinguflac 8y ago
I can’t speak for pi-hole, but Diversion on Asuswrt-Merlin works fantastic for me. No ads ever except for YouTube ads lately due to google’s changes to how they serve ads from the same servers they provide services on.
- jlarocco 8y ago
  > No ads ever except for YouTube ads lately due to google’s changes to how they serve ads from the same servers they provide services on. Thats what I meant by network level blocking doesn't work very well. Using uBlock Origin, I don't see YouTube ads.
  - givinguflac 8y ago
    There's a huge difference between "doesn't work very well" and "works perfectly except for one really sneaky ad company, sometimes". How does ublock origin cover scripts and ads for my entire network? Did you even look at what I'm talking about before making such general statements? My router blocks hundreds of thousands of incidents per week, and there are only two people in my household. One can't use a browser plugin on android tv, Apple TV, smart tv, and a million other devices. By your own logic, ublock origin doesn't work very well. See what I mean?
maverick2007 8y ago
Why doesn't it? (Not a leading question, I just don't understand why it doesn't) Isn't the way uBlock and the like work is that they see network requests from a blacklist and not load those resources? Isn't network level blocking just moving that from the local device up a level?

paavoova 8y ago

So this only blocks/matches known domains? That isn't nearly as useful as to what uMatrix/uBlock allow, such as filtering by resource type. E.g. you may want to disable all JS by default, which uBlock allows.

berbec 8y ago
Yes. Pihole and the like can only block domains, adserver.doubleclick.com.

davb 8y ago

One of my concerns is that DNS over HTTP(s) is really just a way to obfuscate DNS queries from the oversight of network level ad blockers like Pi Hole, AdBloka et al.

berbec 8y ago
That's why you use DoH from you pihole, not your computer/phone etc.
- davb 8y ago
  Of course, but my concern is that DoH makes it easier for apps (Chrome, etc) to handle their own DNS queries internally rather than relying on the device's network libraries. MiTM intercepting HTTP(s) traffic on my Android devices is really difficult due to certificate pinning. The only way to quantify how many unexpected requests apps are making was to watch DNS traffic. If, one day, these apps just make a single DNS request to Google's DoH host then encrypt all their traffic from there onwards, I'd have no insight into what's going on in my own device.
  - anfilt 8y ago
    I am not a fan of DNS over HTTPs for similar reasons too.
ocdtrekkie 8y ago
You might've noticed most of the new Internet protocols Google is championing move to pushing things through HTTPS where they cannot be intercepted and provide a guaranteed tunnel between the servers (statistically speaking, Google), and the browser (also, statistically speaking, Google). I would never go so far as to speculate why, but it does appear Google is heavily focused on this.

propogandist 8y ago

The new trend to slip through is hiding behind cloudflare. I see cloudflare urls being loaded within cloudflare URLs to obfuscate the source of ads and scripts

Kadin 8y ago

I have a Pi-hole and use uBlock; when I turn off uBlock and use the Pi-hole alone, a ton of ads still seem to come through. This is with the default blocklists (StevenBlack, MalwareDomains, sysctl.org, zeustracker.abuse.ch; about 8 total). Maybe I'm not adding enough lists, but "out of the box" it doesn't seem to cut it.

jaxn 8y ago
You may have a secondary DNS. Sometimes that isn't even intentional as ISP modems automatically upstream failed DNS regardless of the local DHCP settings (I'm looking at you AT&T Fiber)